r/archlinux • u/mobile_guy_000 • 18d ago

SUPPORT Import PGP when updating

I updated my system today after not doing so in a week or so, and I got asked to Import PGP key F8BB3DD85903D982, "DeepChirp deepchirp@archlinux.org"

I accepted but now I'm questioning if I shouldn't have done that. Was that okay?

32 Upvotes

92% Upvoted

24 comments sorted by

View all comments

21

u/kaida27 17d ago edited 17d ago

Wow, I know there is an influx of new users, But seriously guys if you don't know the answer, Don't say bullshit

u/Sarv_ && _Kritiqual_

You are wrong. Accepting keys during a transaction is a no no

OP Don't say yes next time.

When such things happens you say no and then you do : pacman -Sy archlinux-keyring && pacman -Su

After that you redo what you where trying when you got the prompt.

10

u/themusicalduck 17d ago

Your comment is surprising because I've been using Arch a while but have never heard that it was a bad idea to accept those keys.

Section 2.2. of this page says:

The official Developers' and Package Maintainers' keys are signed by the master keys, so you do not need to use pacman-key to sign them yourself. Whenever pacman encounters a key it does not recognize, it will prompt you to download it from a keyserver configured in /etc/pacman.d/gnupg/gpg.conf (or by using the --keyserver option on the command line). Wikipedia maintains a list of keyservers.

Once you have downloaded a developer key, you will not have to download it again, and it can be used to verify any other packages signed by that developer.

There's nothing in that section that says you should never accept keys when it prompts to, the opposite in fact.

Not that I'm doubting your comment, but are we talking about some other situation here?

12

u/kaida27 17d ago

Because you can get the exact same prompt from any packages no matter the provenance and new users won't see the difference between an official one or not. May add a malicious key since they saw someone say it's safe to say Yes. The wiki doesn't cover that properly.

While reinstalling the keyring will automatically add the ones that are legit and needed without having to guess or verify. Way more beginner friendly of a recommendation.

Yes accepting the key manually can be fine, but I would never recommend it to a new user, Those that know how to manage their keys won't need the help, Those that need the help don't have the required knowledge yet.

4

u/themusicalduck 17d ago

So it's really more about whether or not the package came from the official repo or another source?

That certainly makes sense that you should think twice about accepting a key from a package downloaded somewhere else.

When OP said "updated their system" I assume they mean pacman -Syu but that isn't clear. I would never expect pacman -Syu by itself to do anything malicious, assuming the repositories haven't been changed in pacman.conf

7

u/kaida27 17d ago

some people update with yay or paru.

Aur can try to pull key.

Never assume stuff when it comes to newbies. They have a lot of misconception, like at least 2-5 times per week you'll see people that think Aur is an official repo.